Skip to main content
Last updated: October 6, 2026 This Data Processing Agreement (this “DPA”) forms part of the agreement between the Gallabox entity that is party to it (“Gallabox”) and the customer that is party to it (the “Customer”) governing the Customer’s use of the Platform, whether the Terms of Service, a Master Services Agreement, an Order Form or a Statement of Work (the “Principal Agreement”). This DPA applies from the date the Customer accepts or signs the Principal Agreement and does not require a separate signature.

​
1. DEFINITIONS AND INTERPRETATION

1.1 Definitions. Capitalised terms not defined in this DPA have the meanings given in the Principal Agreement. In this DPA:
  • “Applicable Data Protection Law” means the data protection and privacy laws that apply to the processing of Customer Personal Data under this DPA, including, where applicable, the Digital Personal Data Protection Act, 2023 (the “DPDPA”), Regulation (EU) 2016/679 (the “GDPR”), the GDPR as it forms part of the law of the United Kingdom (the “UK GDPR”) and the California Consumer Privacy Act of 2018 (the “CCPA”), each as amended or replaced.
  • “Controller”, “Processor”, “Data Subject”, “Personal Data” and “processing” have the meanings given in Applicable Data Protection Law. “Controller” includes a “Data Fiduciary” under the DPDPA and a “business” under the CCPA, and “Processor” includes a “Data Processor” under the DPDPA and a “service provider” under the CCPA.
  • “Customer Personal Data” means Personal Data that Gallabox processes on behalf of the Customer through the Platform, including Personal Data of End Users and of the Customer’s own users of the Platform.
  • “End User” means an individual who exchanges messages with the Customer through the Platform, including over WhatsApp, Instagram or any other channel connected to the Platform.
  • “EU SCCs” means the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914, and “UK Addendum” means the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner, each as amended or replaced.
  • “Security Incident” means a breach of Gallabox’s security leading to the accidental or unlawful destruction, loss or alteration of, or unauthorised disclosure of or access to, Customer Personal Data.
  • “Sub-Processor” means a third party engaged by Gallabox to process Customer Personal Data.
1.2 Precedence. If this DPA conflicts with the Principal Agreement, this DPA prevails on matters relating to Customer Personal Data. Where the EU SCCs or the UK Addendum apply, they prevail over both.

​
2. ROLES AND SCOPE

2.1 Roles. The Customer is the Controller, and Gallabox is a Processor, of Customer Personal Data. Where the Customer acts as a Processor for a third party, Gallabox is its Sub-Processor, and the Customer shall obtain every authorisation from that third party needed for Gallabox to process Customer Personal Data under this DPA. 2.2 Gallabox as Controller. Gallabox acts as an independent Controller, and Section 4 (Gallabox Obligations) and Section 5 (Sub-Processors) do not apply, where it processes Personal Data (a) for billing, payment collection, and tax and audit records; (b) for security monitoring and fraud and abuse prevention; (c) to improve and train the Platform under Section 6.2 (Product improvement and training); or (d) relating to the Customer’s representatives or visitors to Gallabox’s website, which Gallabox’s Privacy Policy governs. 2.3 Processing details. Schedule 1 (Processing Details) sets out the subject matter, nature, purposes and duration of the processing, and the categories of Personal Data and Data Subjects.

​
3. CUSTOMER OBLIGATIONS

3.1 Lawful basis. The Customer warrants that (a) it has, and will maintain, a lawful basis for all processing of Customer Personal Data that it instructs, including processing under Section 6 (AI Features); (b) it has given every notice, and obtained every consent, that Applicable Data Protection Law requires from Data Subjects, including End Users; and (c) its instructions to Gallabox comply with Applicable Data Protection Law. 3.2 Content and configuration. The Customer decides what Personal Data it collects, sends and stores through the Platform, and configures the Platform’s retention and deletion settings. The Platform does not screen message content, and the Customer is responsible for any sensitive or special category Personal Data that End Users share with it. 3.3 Indemnity. The Customer shall indemnify Gallabox against any claim, fine, penalty or loss arising from a breach of Section 3.1 (Lawful basis) or from the Customer’s failure to comply with its terms with any operator described in Section 5.5 (Channels and integrations).

​
4. GALLABOX OBLIGATIONS

4.1 Instructions. Gallabox shall process Customer Personal Data only on the Customer’s documented instructions, which comprise the Principal Agreement, this DPA and the Customer’s configuration and use of the Platform, unless the law requires otherwise, in which case Gallabox shall inform the Customer before processing unless the law prohibits it. Gallabox shall inform the Customer if it considers that an instruction infringes Applicable Data Protection Law, and may suspend the affected processing until the instruction is withdrawn or modified. 4.2 Personnel. Gallabox shall limit access to Customer Personal Data to personnel who need it and who are bound by confidentiality obligations. 4.3 Security. Gallabox shall implement technical and organisational measures appropriate to the risk of the processing, as summarised in Schedule 2 (Security Measures). Gallabox may update those measures, provided the update does not materially reduce the overall level of protection. 4.4 Assistance. Taking into account the nature of the processing and the information available to it, Gallabox shall provide reasonable assistance to the Customer with (a) Data Subject requests, which the Customer shall first address using the Platform’s self-service tools; and (b) the Customer’s obligations on security, Security Incident notification, data protection impact assessments and consultation with regulators. Gallabox may charge at its then-current rates for assistance beyond the Platform’s self-service tools, except where the assistance is needed because of Gallabox’s breach of this DPA. If a Data Subject contacts Gallabox directly, Gallabox shall refer them to the Customer. 4.5 Security Incidents. Gallabox shall notify the Customer without undue delay, and where feasible within seventy-two (72) hours, after becoming aware of a Security Incident, and shall provide the information reasonably required under Applicable Data Protection Law as it becomes available. Notification is not an admission of fault or liability. 4.6 Audits. On written request, and not more than once in any twelve (12) month period, Gallabox shall make available to the Customer the information reasonably necessary to demonstrate its compliance with this DPA, which may take the form of its current third-party audit reports or certifications or its responses to a reasonable security questionnaire. Where those materials are insufficient to demonstrate compliance, or a regulator requires it, the Customer may conduct an inspection on at least thirty (30) days’ written notice, during business hours, at its own cost, and subject to the confidentiality obligations Gallabox reasonably requires. All audit information is Gallabox’s Confidential Information. 4.7 Return and deletion. After the Principal Agreement ends, the Customer may export Customer Personal Data using the Platform during the export period set out in the Principal Agreement (or, if none is set out, one hundred and eighty (180) days). Gallabox shall then delete or anonymise Customer Personal Data from its active systems within thirty (30) days, and from its backups in its ordinary backup cycle, except where the law requires Gallabox to retain it. Retained data remains subject to this DPA.

​
5. SUB-PROCESSORS

5.1 Authorisation. The Customer generally authorises Gallabox to engage Sub-Processors, including its affiliates. 5.2 Sub-Processor list. Gallabox shall maintain a current list of its Sub-Processors, stating each one’s name, function and processing location, and shall provide it to the Customer on written request. 5.3 New Sub-Processors. Gallabox shall notify the Customer at the email address associated with its account at least thirty (30) days before engaging a new Sub-Processor. The Customer may object in writing on reasonable data protection grounds within that period. If the parties cannot resolve the objection in good faith within thirty (30) days, the Customer’s sole remedy is to terminate the affected Services on written notice. 5.4 Sub-Processor terms. Gallabox shall impose on each Sub-Processor written data protection obligations no less protective in substance than those in this DPA, and remains responsible for its Sub-Processors’ performance of those obligations, subject to the limitations of liability in the Principal Agreement. 5.5 Channels and integrations. The following are not Sub-Processors, and Gallabox is not responsible for their processing, security or availability: (a) Meta and any other operator of a messaging channel connected to the Platform, which processes Personal Data under the Customer’s own terms with that operator, which the Customer shall maintain; (b) any third-party tool that the Customer connects to the Platform; and (c) any payment provider used by End Users.

​
6. AI FEATURES

6.1 AI processing. When the Customer uses the Platform’s AI features, Gallabox sends to its AI Sub-Processors the Customer Personal Data needed to generate the requested output. 6.2 Product improvement and training. The Customer authorises Gallabox to use Customer Personal Data, pseudonymised where reasonably practicable, to improve, develop and train the Platform and its AI features. Where the Customer’s plan or the Principal Agreement provides an opt-out and the Customer exercises it, Gallabox shall stop using Customer Personal Data received after the opt-out for those purposes. 6.3 Anonymised data. Data anonymised so that it no longer relates to an identifiable individual is not Customer Personal Data. Gallabox may use it for any purpose and shall not attempt to re-identify it.

​
7. HOSTING AND INTERNATIONAL TRANSFERS

7.1 Hosting. The Platform application is hosted in the United States. Customer Personal Data is stored in the region applicable to the Customer’s account. Operating the Platform requires Customer Personal Data to be accessed from the United States and from the locations of Gallabox’s personnel and Sub-Processors, and the Customer authorises those transfers. Messages sent over Meta channels also pass through infrastructure that Meta operates and Gallabox does not control. 7.2 Transfers. Each party shall comply with its obligations under Applicable Data Protection Law for transfers of Customer Personal Data. If transfers to a country are restricted under section 16 of the DPDPA, the parties shall cooperate on any measures reasonably required. 7.3 EU and UK transfers. Where the GDPR applies to a transfer of Customer Personal Data to Gallabox in a country without an adequacy decision, the EU SCCs are incorporated into this DPA, as Module Two where the Customer is a Controller and Module Three where it is a Processor, with the elections and annex information in Schedule 1 (Processing Details). Where the UK GDPR applies to such a transfer, the UK Addendum is incorporated on the same basis. Acceptance of the Principal Agreement is acceptance of the EU SCCs and the UK Addendum.

​
8. GENERAL

8.1 Liability. Each party’s liability under this DPA, including under the EU SCCs and the UK Addendum to the extent they permit, is subject to the limitations and exclusions of liability in the Principal Agreement. 8.2 Duration. This DPA applies for as long as Gallabox processes Customer Personal Data, and provisions that by their nature should survive its end shall survive. 8.3 Updates. Gallabox may update this DPA by publishing a new version on its website. An update that materially reduces the protection of Customer Personal Data takes effect thirty (30) days after Gallabox notifies the Customer by email, and the Customer may, as its sole remedy, terminate the affected Services within that period. Any other update takes effect on publication. 8.4 Governing law. The governing law and dispute resolution provisions of the Principal Agreement apply to this DPA, except that the EU SCCs and the UK Addendum are governed as set out in Schedule 1 (Processing Details).

​
SCHEDULE 1: Processing Details

This Schedule also completes Annex I of the EU SCCs.

​
Part A: Parties

  • Data exporter. The Customer, as Controller (or as Processor under Section 2.1 (Roles)). Contact details: as set out in the Principal Agreement or the Customer’s account.
  • Data importer. Gallabox, as Processor (or as Sub-Processor under Section 2.1 (Roles)). Contact: security@gallabox.com.
  • Activities. Provision and use of the Platform and the Services under the Principal Agreement.

​
Part B: Description of processing

  • Data Subjects. End Users; the Customer’s own users of the Platform; and any other individual whose Personal Data the Customer processes through the Platform.
  • Personal Data. Contact details (names, phone numbers, email addresses and messaging handles); message content (text, images, voice notes, videos, documents and other media); message metadata; account data of the Customer’s users; device and usage data; data from integrations the Customer connects; and any other Personal Data the Customer chooses to process through the Platform.
  • Sensitive data. None intended. See Section 3.2 (Content and configuration).
  • Nature and purposes. Collecting, storing, routing, transmitting, analysing and deleting Personal Data to provide the Platform and the Services, including messaging, AI features, analytics, support and abuse prevention.
  • Frequency. Continuous.
  • Duration and retention. For the term of the Principal Agreement, with retention during the term as the Customer configures it, and afterwards under Section 4.7 (Return and deletion).
  • Sub-Processors. As listed under Section 5.2 (Sub-Processor list).

​
Part C: EU SCC and UK Addendum elections

Clause 7. The docking clause does not apply. Clause 9(a). Option 2 (general written authorisation) applies, with the notice period in Section 5.3 (New Sub-Processors). Clause 11(a). The optional independent dispute resolution wording does not apply. Clause 13. The competent supervisory authority is determined in accordance with Clause 13. Clauses 17 and 18. Option 1 applies, and the EU SCCs are governed by the laws of Ireland. Disputes are resolved by the courts of Ireland. Annexes II and III. Annex II is completed by Schedule 2 (Security Measures). Annex III is completed by the list under Section 5.2 (Sub-Processor list). UK Addendum. Tables 1 to 3 are completed by reference to this DPA and this Schedule. For Table 4, the Importer may end the UK Addendum as its terms permit.

​
SCHEDULE 2: Security Measures

This Schedule also completes Annex II of the EU SCCs. Gallabox maintains the following measures, which it may update under Section 4.3 (Security).
  1. Access control. Access to production systems is limited to a small number of authorised personnel on a need-to-know basis, who must record the reason for each access.
  2. Logging. Access to production infrastructure is logged.
  3. Encryption. Data is encrypted in transit over public networks. Credentials, including API keys, passwords and integration tokens, are encrypted at rest.
  4. Hosting. The Platform runs on an established third-party cloud infrastructure provider, which maintains its own physical and environmental security controls.
  5. Personnel. Personnel with access to Customer Personal Data are bound by confidentiality obligations.
  6. Assurance. Gallabox holds a SOC 2 report issued by an independent auditor, which is available on request under Section 4.6 (Audits).
For Gallabox’s current Sub-Processors, see Sub-processors.